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Abstract 

Is there a general theorem that tehs us when we can hope for exponential speedups from 
quantum algorithms, and when we cannot? In this paper, we make two advances toward such 
a theorem, in the black-box model where most quantum algorithms operate. 

First, we show that for any problem that is invariant under permuting inputs and outputs 
(like the collision or the element distinctness problems), the quantum query complexity is at 
least the 9*'' root of the classical randomized query complexity. This resolves a conjecture of 
Watrous from 2002. 

Second, inspired by recent work of O'Donnell et al. and Dinur et al., we conjecture that every 
bounded low-degree polynomial has a "highly influential" variable. Assuming this conjecture, 
we show that every T-query quantum algorithm can be simulated on most inputs by a poly (T)- 
query classical algorithm, and that one essentially cannot hope to prove P 7^ BQP relative to a 
random oracle. 

1 Introduction 

Perhaps the central lesson gleaned from fifteen years of quantum algorithms research is this: 

Quantum computers can offer superpolynomial speedups over classical computers, 
but only for certain "structured" problems. 

The key question, of course, is what we mean by "structured." In the context of most existing 
quantum algorithms, "structured" basically means that we are trying to determine some global 
property of an extremely long sequence of numbers, assuming that the sequence satisfies some 
global regularity. As a canonical example, consider Period-Finding, the core of Shor's algorithms 
for factoring and discrete logarithm [22]. Here we are given black-box access to an exponentially- 
long sequence of integers X = (xi, . . . ,xn); that is, we can compute Xi for a given i. We are asked 
to find the period of X — that is, the smallest A; > such that Xj = Xj__fc for all i > k — promised 
that X is indeed periodic, with period k <^ N. The requirement of periodicity is crucial here: 
it is what lets us use the Quantum Fourier Transform to extract the information we want from a 
superposition of the form 
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For other known quantum algorithms, X needs to be (for example) a cyclic shift of quadratic 
residues |12] . or constant on the cosets of a hidden subgroup. 

By contrast, the canonical example of an "unstructured" problem is the Grover search problem. 
Here we are given black-box access to an A/'-bit string xi, . . . ,xn £ {0, 1}^, and are asked whether 
there exists an i such that Xj = 10 Grover |15j gave a quantum algorithm to solve this problem 
using 0{-/N) queries [15], as compared to the Q.{N) needed classically. However, this quadratic 
speedup is optimal, as shown by Bennett, Bernstein, Brassard, and Vazirani [7j. For other "un- 
structured" problems — such as computing the Parity or Majority of an A'^-bit string — quantum 
computers offer no asymptotic speedup at all over classical computers (see Beals et al. pj). 

Unfortunately, this "need for structure" has essentially limited the prospects for superpolyno- 
mial quantum speedups to those areas of mathematics that are liable to produce things like periodic 
sequences or sequences of quadratic residues]! This is the fundamental reason why the greatest 
successes of quantum algorithms research have been in cryptography, and specifically in number- 
theoretic cryptography. It helps to explain why we do not have a fast quantum algorithm to solve 
NP-complete problems (for example), or to break arbitrary one-way functions. 

Given this history, the following problem takes on considerable importance: 

Problem 1 (Informal) For every "unstructured" problem f , are the quantum query complexity 
Q{f) and the classical randomized query complexity R(/) polynomially related? 

Despite its apparent vagueness. Problem [1] can be formalized in several natural and convincing 
ways — and under these formalizations, the problem has remained open for about a decade. 

1.1 Formalizing the Problem 

Let S C [M]^ be a collection of inputs, and let / : 5" ^ {0, 1} be a function that we are trying to 
compute. In this paper, we assume for simplicity that the range of / is {0, 1}; in other words, that 
we are trying to solve a decision problem. It will also be convenient to think of / as a function 
from [M]^ to {0, 1,*}, where * means 'undefined' (that is, that a given input X G \M]^ is not in 
/'s domain S). 

We will work in the well-studied decision-tree model. In this model, given an input X = 
(xi, . . . , x^r), an algorithm can at any time choose an i and receive Xi. We count only the number of 
queries the algorithm makes to the Xj's, ignoring other computational steps. Then the deterministic 
query complexity of /, or D (/), is the number of queries made by an optimal deterministic algorithm 
on a worst-case input X ^ S. The (bounded-error) randomized query complexity R (/) is the 
expected number of queries made by an optimal randomized algorithm that, for every X ^ S, 
computes f (X) with probability at least 2/3. The (bounded-error) quantum query complexity 
Q (/) is the same as R(/), except that we allow quantum algorithms. Clearly Q (/) < R(/) < 
D (/) < N for all /. See Buhrman and de Wolf [11] for detailed definitions as well as a survey of 
these measures. 

If 5 = [M]'\ then we say / is total, while if M = 2, then we say / is Boolean. The case of total 
/ is relatively well-understood. Already in 1998, Beals et al. [6j showed the following: 

variant asks us to find an i such that Xi = 1, under the mild promise that such an i exists. 
^Here we exclude BQP-complete problems, such as simulating quantum physics (the "original" application of 
quantum computers), approximating the Jones polynomial : 4 , and estimating a linear functional of the solution of a 
well-conditioned linear system [16| . 
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Theorem 2 (Beals et al. [6]) D (/) = 0{Q{ff) for all total Boolean functions f : {0,1} 
{0,1}. 



Furthermore, it is easy to generahze Theorem [2] to show that D (/) = 0(Q(/) ) for all total 
functions / : [M]^ {0)1}) iiot necessarily Booleanjfl In other words, for total functions, the 
quantum query complexity is always at least the 6*^ root of the classical query complexity. The 
largest known gap between D (/) and Q (/) for a total function is quadratic, and is achieved by the 
OR function (because of Grover's algorithm). 

On the other hand, as soon as we allow non-total functions, we can get enormous gaps. Aaronson 
[2] recently gave a Boolean function f : S ^ {0,1} for which R(/) = n{VN), yet Q (/) = O (1). 
Other examples, for which R(/) = r2(\/iV) and Q (/) = O (log log log A^), follow easily from 
Simon's algorithm [23] and Shor's algorithm [22] . Intuitively, these functions / achieve such large 
separations by being highly structured: that is, their domain S includes only inputs that satisfy a 
stringent promise, such as encoding a periodic function, or (in the case of [2]) encoding two Boolean 
functions, one of which is correlated with the Fourier transform of the other one. 

By contrast with these highly-structured problems, consider the collision problem: that of 
deciding whether a sequence of numbers xi, . . . ,xj\[ G [M]^ is one-to-one (each number appears 
once) or two-to-one (each number appears twice). Let Col{X) = 1 if X is one-to-one and 
Col{X) = 2 if X is two-to-one, promised that one of these is the case. Then Col(X) is not 
a total function, since its definition involves a promise on X. Intuitively, however, the collision 
problem seems much less "structured" than Simon's and Shor's problems. One way to formalize 
this intuition is as follows. Call a partial function / : [M]^ {0, 1,*} permutation-invariant if 

/ (xi, . . . , Xiv) = / (r (x^(i)) , . . . , r (x^(Ar))) 

for all inputs X G [M]^ and all permutations a G Sj\[ and r G Sm- Then Col(A) is permutation- 
invariant: we can permute a one-to-one sequence and relabel its elements however we like, but it 
is still a one-to-one sequence, and likewise for a two-to-one sequence. Because of this symmetry, 
attempts to solve the collision problem using (for example) the Quantum Fourier Transform seem 
unlikely to succeed. And indeed, in 2002 Aaronson [Ij proved that Q (Col) = 17 (A^^/^) : that 
is, the quantum query complexity of the collision problem is at most polynomially better than 
its randomized query complexity of 0(\/iV)- The quantum lower bound was later improved to 
Q (A^^/^) by Aaronson and Shi [3j, matching an upper bound of Brassard, Il0yer, and Tapp [10]. 

Generalizing boldly from this example, John Watrous (personal communication) conjectured 
that the randomized and quantum query complexities are polynomially related for every permutation- 
invariant problem: 

Conjecture 3 (Watrous 2002) R (/) < Q {f)'^^^^ for every partial function f : [M]^ ^{0,1, *} 
that is permutation-invariant. 

Let us make two remarks about Conjecture El First, the conjecture talks about randomized 
versus quantum query complexity, since in this setting, it is easy to find functions / for which R (/) 

^For Theorem [2] is proved by combining three ingredients: D (/) = O (C (/) bs (/)), C (/) = 0(bs(/)^), and 
(/) = 0{Q{f)^) (where C (/) is the certificate complexity of / and bs (/) is the block sensitivity). And all three 
ingredients go through with no essential change if we set M > 2, and define suitable M-ary generalizations of C (/) 
and bs (/). (We could also convert the non-Boolean function / : [M]^ {0, 1} to a Boolean one, but then we would 
lose a factor of log M.) 
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and Q (/) are both tiny but D (/) is huge. As an example, consider the Deutsch-Jozsa problem: 
given a Boolean input (xi, . . . ,xn), decide whether the Xj's are all equal or whether half of them 
are 1 and the other half are 0, promised that one of these is the case. 

Second, if M = 2 (that is, / is Boolean), then Conjecture [3] follows relatively easily from known 
results: indeed, we prove in Appendix E] that R(/) = 0(Q(/)^) in that case. So the interesting 
case is when M ^> 2, as it is for the collision problem. 

Conjecture [3] provides one natural way to formalize the idea that classical and quantum query 
complexities should be polynomially related for all "unstructured" problems. A different way is 
provided by the following conjecture, which we were aware of since about 1999: 

Conjecture 4 (folklore) Let Q be a quantum algorithm that makes T queries to a Boolean input 
X = (xi, . . . ,X7v), and let e > 0. Then there exists a deterministic classical algorithm that makes 
poly (T, 1/e, 1/(5) queries to the Xi 's, and that approximates Q 's acceptance probability to within an 
additive error e on a 1 — 5 fraction of inputs. 

Loosely speaking, while Conjecture [3] said that there was no property of a symmetric oracle 
string that quantum algorithms can evaluate super polynomially faster than classical ones. Conjec- 
ture m says that there is no such property of a random oracle string. 

Conjecture H] would imply a far-reaching generalization of the result of Beals et al. [6] that 
D (/) = 0(Q (/)^) for all total Boolean functions /. In particular, define the e-approximate query 
complexity of a Boolean function / : {0, 1}^ {0, 1}, or (/), to be the minimum number of 
queries made by a deterministic algorithm that evaluates / on at least a 1 — e fraction of inputs 
X. Likewise, let (/) be the minimum number of queries made by a quantum algorithm that 
evaluates / on at least a 1 — e fraction of inputs. Then Conjecture H] implies that Dg (/) and 
Qs (/)> polynomially related for all Boolean functions / and all e > 6 > 0. This would provide 
a quantum counterpart to a beautiful 2002 result of Smyth [24], who solved an old open problem 
of Steven Rudich by showing that Dg (/) = ©(C^s/sg (/)^ /e^) for all e > (where Cs (/) denotes 
the "(5-approximate certificate complexity" of /). 

More dramatically, if Conjecture H] holds, then we basically cannot hope to prove P 7^ BQP 
relative to a random oracle. This would answer a question raised by Fortnow and Rogers [14J in 
1998, and would contrast sharply with the situation for non-random oracles: we have had oracles 
relative to which P 7^ BQP, and indeed BQP MA, since the work of Bernstein and Vazirani [8] in 
the early 1990s. More precisely, under some suitable complexity assumption (such as P = P*^), 
we would get BQP"^ C AvgP"^ with probability 1 for a random oracle A. Here AvgP is the class 
of languages for which there exists a polynomial-time algorithm that solves a 1 — o(l) fraction of 
instances of size n. In other words, separating BQP from AvgP relative to a random oracle would be 
as hard as separating complexity classes in the unrelativized world. This would provide a quantum 
counterpart to a theorem of Impagliazzo and Rudich (credited in [E]), who used the powerful 
results of Kahn, Saks, and Smyth pLTI to show that if P = NP, then NP^ n coNP^ C ioAvgP^ with 
probability 1 for a random oracle 

^Here ioAvgP means "average-case P for infinitely many input lengths n." The reason Impagliazzo and Rudich 
only get a simulation in ioAvgP, rather than AvgP, has to do with the fact that Smyth's result [24] only relates De (/) 
to CgS /3Q (/), rather than D^+s (/) to (/) for all 5 > 0. 
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1.2 Our Results 



Our main contribution in this paper is to prove Watrous's conjecture, that randomized and quantum 
query complexities are polynomially related for every symmetric problem. 

Theorem 5 Conjecture\Mholds. Indeed, R (/) = 0(Q (/)^ polylog Q (/)) for every partial function 
f : [M]^ — > {0, 1,*} that is permutation-invariant. 

We conjecture that R (/) and Q (/) are polynomially related even for functions / satisfying 
one of the two symmetries: namely, / (xi, . . . , X]\f) = f (^^-(i), • • • , Xcr(N)) for all a G S]\f. We also 
conjecture that the exponent of 9 can be improved to 2: in other words, that Grover's algorithm 
once again provides the optimal separation between the quantum and classical models. 

While the proof of Theorem [5] is somewhat involved, it can be entirely understood by those 
unfamiliar with quantum computing: the difficulties lie in getting the problem into a form where 
existing quantum lower bound technology can be applied to it. Let us stress that it was not at all 
obvious a priori that existing quantum lower bounds would suffice here; that they did came as a 
surprise to us. 

We first define and analyze a simple randomized algorithm, which tries to compute / {X) for 
a given X = (xi, . . . ,xn) by estimating the multiplicity of each element Xi. Next, by considering 
where this randomized algorithm breaks down, we show that one can identify a "hard core" within 
/: roughly speaking, two input types A* and B* , such that the difficulty of distinguishing A* from 
B* accounts for a polynomial fraction of the entire difficulty of computing /. The rest of the proof 
consists of lower-bounding the quantum query complexity of distinguishing A* from B* . We do 
so using a hybrid argument: we develop a "chopping procedure" that gradually deforms A* and 
B* to make them more similar to each other, creating L = 0{logN) intermediate input types 
^0 = A*,Ai,A2,...,Al and Bo = B* ,Bi,B2, ■ ■ ■ ,Bl such that Al = Bl- We then show that, 
for every i £ [L], distinguishing Ae from Ae^i (or Be from Bi^i) requires many quantum queries, 
either by a reduction from Midrijanis's quantum lower bound for the Set Equality problem [TH] 
(which was a nontrivial extension of Aaronson and Shi's collision lower bound [3]), or else by an 
application of Ambainis's general quantum adversary theorem [5]. 

Doing this hybrid argument in the "obvious" way produces a bound of the form R (/) < 
Q if)^^^^ polylog A^, which fails to imply a polynomial relationship between R(/) and Q (/) when 
Q(/) < {logNy'-^K However, a more sophisticated hybrid argument gets rid of the polylog A^ 
factor. 

Our second contribution is more exploratory, something we put forward in the hope of inspiring 
followup work. We study Conjectured! the one that stated that every T-query quantum algorithm 
can be simulated on most inputs using T'^^^^ classical queries. We relate this conjecture to a 
fundamental open problem in Fourier analysis and approximation theory. Given a real polynomial 
p : ^ M, let 

lnU\p]:= EX [\p{X)-p{X')\] 
xe{o,i}'^ 

be the influence of the i*'^ variable, where A* means X with the i*^ bit flipped. Then we conjecture 
that every bounded low-degree polynomial has a "highly influential" variable. More precisely: 
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Conjecture 6 (Bounded Polynomials Have Influential Variables) Let p : —>■ W be a 

polynomial of degree d. Suppose that < p{X) < 1 for all X G {0, 1}^, and 

E [\p{X)-piY)\]>e. 

X,Y<^{OA} 

Then there exists an i such that Infj [p] > {e/d)'^^^\ 

We show the following: 
Theorem 7 Assume Conjecture\^ Then 
(i) Conjecture holds. 

(ii) T)e+5 if) < (Qe (/) /Sf^^^ for all Boolean functions f : {0, 1}^ ^ {0, 1} and all e,5 > 0. 
(Hi) If P = P*^, then BQP"^ C AvgP"^ with probability 1 for a random oracle A. 

The main evidence for Conjecture [6] — besides the fact that all the Fourier analysis experts we 
asked were confident of it! — is that extremely similar statements have recently been proved. Firstly, 
O'Donnell, Saks, Schramm, and Servedio [19j proved an analogue of Conjecture [6] for decision trees, 
which are a special case of bounded real polynomials: 

Theorem 8 (O'Donnefl et al. 2005 [H]) Let f : {0, 1}^ {0, 1} be a Boolean function, and 
suppose Pr [/ = 1] Pr [/ = 0] > e. Then there exists an i such that Inf j [/] > 4e/ D (/), where D (/) 
is the decision tree complexity of f . 

Unfortunately, Theorem [8] does not directly imply anything about our problem, even though 
Beals et al. [6] showed that D (/) and Q (/) are polynomially related for all total Boolean functions 
/. The reason is that the acceptance probability of a quantum algorithm need not approximate a 
total Boolean function. 

The second piece of evidence for Conjecture [6] comes from a powerful result of Dinur, Friedgut, 
Kindler, and O'Donnell [13], which implies our conjecture, except with Infj [p] > /2^^'^^ instead 
of Infj \p\ > {e/d)'^^^\ Let us state the special case of their result that is relevant for us: 

Theorem 9 (Dinur et al. 2006 |13] ) Let e > 0, and let p : —>■ be a degree-d polynomial 
such that 0<p{X) <1 for all X e {0, 1}^. Then there exists a 2^^'^^ /e^ -junta p : ^ M (that 
is, a polynomial depending on at most 2^^'^'^ /e^ variables) such that 

< e. 

Even though Theorem [9] has an exponential rather than polynomial dependence on l/d, we 
observe that it already has a nontrivial consequence for quantum computation. Namely, it implies 
that any T-query quantum algorithm can be simulated on most inputs using 2^^'^^ classical queriesJl 
Recall that the gaps between classical and quantum query complexities can be super exponential 
(and even A^^(^) versus O (1), as in the example of Aaronson [2j), so even an exponential upper 
bound is far from obvious. 

^Indeed, in this case the classical queries are nonadaptive. 
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2 Quantum Lower Bound for All Symmetric Problems 



In this section we prove Theorem [5l that R(/) = 0(Q (/) polylogQ(/)) for all permutation- 
symmetric /. 

We start with a simple observation that is essential to everything that follows. Since / is 
symmetric, we can group the inputs X = (xi, . . . ,xn) into equivalence classes that we call types. 

Definition 10 Given an input X = (xi, . . . , jjtv) £ [^]^ > type of X is a list of positive 
integers A = (oi, . . . , a„) such that ai > ■ ■ ■ > au and oi + • • • + = X, with each ai recording 
the multiplicity of some integer in X. For convenience, we adopt the convention that Oj = for 
all i > u. 

In other words, a type is just a partition (or Young diagram) that records the multiplicities 
of the input elements. For example, a one-to-one input has type ai = • • • = oat = 1, while a 
two-to-one input has type ai = • • • = = 2. We write X G ^ if X is of type A. Clearly 
/ (X) depends only on the type of X. Furthermore, given a quantum query algorithm Q, we can 
assume without loss of generality that Pr [Q accepts X] depends only on the type of X — since we 
can "symmetrize" Q (that is, randomly permute X's inputs and outputs) prior to running Q. 

2.1 Randomized Upper Bound 

Let X = {xi, . . . ,xn) be an input. For each j £ [M], let kj be the number of i's such that 
Xi = j. Then the first step is to give a classical randomized algorithm that estimates the k^-'s. 
This algorithm, St, is an extremely straightforward sampling procedure (indeed, there is essentially 
nothing else that a randomized algorithm can do here). St will make O (T^^'^ log T) queries, where 
T is a parameter and c G (0, 1] is a constant that we will choose later to optimize the final bound. 

Set U := 24Ti+^lnT 

Choose U indices ii,...,iij € [A'^] uniformly at random with replacement 
Query Xj^ , . . . , Xi^ 
For each j G [M] : 

Let Zj be the number of occurrences of j in (xi-^, . . . ,Xi^) 

Output Kj := y-Zj as the estimate for kj 

We now analyze how well St works. 
Lemma 11 With probability 1 — (l/T), we have [kj — K,j\ < y ^ W ■^^'^ ^ ^ i-^^]- 

Proof. For each j G [M], we consider three cases. First suppose Kj > N /T^^^. Notice that Zj is 
a sum of U independent Boolean variables, and that E [zj] = E = ^kj- So 



Pr ^7 1 — 




> 



NT'' 




2T- 



7 



where the second line follows from a Chcrnoff bound and the third from kj > N/T 
Second, suppose N/T^ < kj < N/T^'". Then 



l-c 



Pr 
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= Pr 

< 2 exp ( - 

< 2 exp 
= 2T-^ 
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where the second line follows from a Chernoff bound and the third from kj < N/T^ 
Third, suppose Kj < N/T^. Then 
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for all sufficiently large T, where the second line follows from Kj < N/T^, the third from the union 
bound, the fourth from Kj < N/T^ (again), and the fifth from U < 2AT'^lnT. 

Notice that there are at most values of j such that kj > N/T^. So putting all three cases 
together, 



Pr 



3j : \Kj-Kj\ > — + ^ 



J J I rjic 



< ^ Pr 
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+ ^ Pr 
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Now call A a 1-type if / (X) = 1 for all X e ^, or a 0-type if / {X) = for all X e A. Consider 
the following randomized algorithm TZt to compute / (X) : 
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Run St to find an estimate /5j for each Kj 

Sort the Ki's in descending order, so that /5i > • • • > km 

If there exists a 1-type A = {ai,a2, ■ ■ ■) such that — ai| < -y- + ^ 

for all i, then output f (X) = 1 
Otherwise output / (X) = 

Clearly TZt makes O (T^+^logT) queries, just as St does. We now give a sufficient condition 
for TZt to succeed. 



Lemma 12 Suppose that for all 1-types A = (ai, 02, . . .) and 0-types B = (61, 62, . . .), there exists 
an i such that | Oj — 6j | > ^ + 
hence R{f) = O (r^+^logT). 



an i such that \ai — bi\ > ^ + . T/ien T^t computes f with bounded probability of error, and 



Proof. First suppose X G A where A = (ai,02,...) is a 1-type. Then by Lemma I 111 with 
probability 1 — O (l/T) we have |Kj — aj| < + ^ for alH (it is easy to see that sorting the /Sj's 
can only decrease the maximum difference). Provided this occurs, TZt finds some 1-type close to 
K2, . . .) (possibly A itself) and outputs / {X) = 1. 

Second, suppose X £ B where ;S = (61, 62, . . .) is a 0-type. Then with probability 1 — O (l/T) 
we have |Kj — 6j| < + ^fe for all i. Provided this occurs, by the triangle inequality, for every 
1-type A = (oi, a2, . . .) there exists an i such that 

11 , , ,~ , , ^ «i 
\Ki - Oil > \ai - bi\ - \Ki - bi\ > — + —. 

Hence TZt does not find a 1-type close to (ki, K2, . . .), and it outputs / {X) = 0. ■ 

In particular, suppose we keep decreasing T until there exists a 1-type A* = (01,02, . . .) and a 
0-type B* = (61, 62, . . .) such that 

\ai -bi\<—+ (1) 

for all i, stopping as soon as that happens. Then Lemma [12] implies that we will still have 
R (/) = O (T^^*^ log T) . For the rest of the proof, we will fix that "almost as small as possible" 
value of T for which ([1]) holds, as well as the 1-type A* and the 0-type B* that TZt "just barely 
distinguishes" from one another. 



2.2 The Chopping Procedure 

Given two sets of inputs A and B with = 0, let Q {A, B) be the minimum number of queries 

made by any quantum algorithm that accepts every X € A with probability at least 2/3, and 
accepts every Y £ B with probability at most 1/3. Also, let {A, B) be the minimum number of 
queries made by any quantum algorithm that accepts every X G A with at least some probability 
p, and that accepts every Y G B with probability at most p — e. Then we have the following basic 
relation: 



Proposition 13 Q {A, B) = O {\ {A, B)) for all A, B and all e > 0. 
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Proof. This follows from standard amplitude estimation techniques (see Brassard et al. [9] for 
example) . ■ 

The rest of the proof is going to consist of lower-bounding Q{A*,13*), the quantum query 
complexity of distinguishing inputs of type A* from inputs of type B*. We do this via a hybrid 
argument. Let L := [log2 N~\. At a high level, we will construct two sequences of types, ^o> • • • > -^L 
and Bo, . . . , Bl, such that 

(i) Ao = A*, 

(ii) Bo=B*, 

(in) Al = Bl, and 

(iv) Q {Ae,Ae-i) and Q {B^,Bf^i) are large for every t. G [L\. 

Provided we can do this, it is not hard to see that we get the desired lower bound on Q {A* ,B*). 
For suppose a quantum algorithm distinguishes = from Bq = B* with constant bias. Then 
by the triangle inequality, it must also distinguish some Ae from Ae+i, or some Bi from Bi+i, with 
reasonably large bias (say ^{\/\ogN)). And by Proposition 1131 any quantum algorithm that 
succeeds with bias e can be amplified, with O (1/e) overhead, to an algorithm that succeeds with 
constant bias. 

We now describe the procedure for creating the intermediate types Ai and B^. Intuitively, we 
want to form Ai from Ae-i, and Bg from Bg-i, by "chopping the rows" of their respective Young 
diagrams, whenever a row of Ae sticks out further than the corresponding row of Bi or vice versa. 
This way, we can gradually make Ag and Bi more similar to one another. To describe how this 
works, it will be convenient to relax the notion of a type slightly. Let a row-array be a list of 2N 
nonnegative integers (ai, . . . , a2N), not necessarily sorted, such that oi + • • • + a2N = Note that 
every type (oi, . . . , o^) is also a row-array, if we adopt the convention that = • • • = a2N = 0. 
Also, every row-array (ai, . . . , a27v) can be converted to a type A = type (oi, . . . , a2N) in a unique 
way, by simply sorting the aj's in descending order. 

We construct the intermediate types Ai,A2, ■ ■ ■ via the following procedure. In this procedure, 
(ai, . . . , a2N) is a row-array that is initialized to A*, and B* = (bi,b2, ■ ■ ■)■ 

let P be the first power of 2 greater than or equal to A'^ 
for i -.= 1 to L 

for every i £ [2N] such that Ui - bi > and Oj > 

set Oj := ai — P/2^ 

find a j G [2A^] such that aj = bj =0, and set aj := P/2^ 
set Ae := type (ai, . . . , a2N) 
next i 

The procedure to produce Bi,B2,--- is exactly the same, except with the roles of a and b 
reversed. The procedure is illustrated pictorially in Figured! 

We start with some simple observations. First, by construction, this procedure halts after 
L = O (log A^) iterations. Second, within a given iteration i, no row i is ever chopped more than 
once — for if it could be, then it would have been chopped in a previous iteration. (This is just 
saying that the integer Oj — bi can be written uniquely as a sum of powers of 2.) Third, initially 
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Figure 1: Chopping a row of Ag^s Young diagram to make it more similar to Bg. 



ii = bi = for all + 1 < i < 2N, and there are at most — 1 chopping steps throughout the 
whole procedure. That is why it is always possible to find a j £ such that aj = bj = 0. 
Define 

1 ^ 

11^ - ^11 := 2 X] ~ • 

1=1 

Then it is not hard to see that Ai,A2, ■ ■ ■ and 81,82, ■■ ■ both evolve toward the same final config- 
uration: namely, ||^* — singleton rows, together with one row of length min{aj,&j} for each i 
such that min{aj, bi} > 0. We therefore have the key fact that Al = 8l- 

Notice that — = where r is number of rows that get chopped in the 

iteration. We now prove an upper bound on \\Ai — Ai-i\\ when i is small, which will be useful 
later. 

Lemma 14 If I < (logg T) - 2, then \\Ai - Aii-i\\ < 

Proof. Let C be the set of rows that are chopped in going from Ai-i to Af, then each row 
i £ C decreases in length by . It follows that, if we let j = j (i) be the "ancestral row" in 
A* = (ai, 02, . . .) that i came from, we must have 

P , , , 3iV a,- + bi 
< \ai - bi\ < h — -■ 

Since i < (log2 T) — 2, the left inequality implies 

, , 47V 
\aj-bj\ > —, 

which combined with the right inequality yields 

+ bj 
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Now let R := IJiec-? (^) ancestral rows. Then 

\\Ai - Ai-i\\ < ^ |ai - bi\ 



i&R 






<-^{ 


3iV 


a-i + bi 




Oj + 6j 




^ 8iV 
— j^"^ 







2.3 Quantum Lower Bounds 

Recall that we listed four properties that we needed the chopping procedure to satisfy. We 
have already seen that it satisfies properties (i)-(iii), so the remaining step is to show that it 
satisfies property (iv). That is, we need to lower-bound Q (^^, An-i), the bounded-error quantum 
query complexity of distinguishing inputs of type from inputs of type Ag-i. (Lower-bounding 
Q {Bi, Bi^i) is exactly analogous.) To do this, it will be convenient to consider two cases: first, 
that forming Ae involved chopping few elements of Ae-i, and second, that it involved chopping 
many elements. We will show that we "win either way," by a different quantum lower bound in 
each case. 

First consider the case that few elements were chopped. Here we prove a lower bound using 
Ambainis's quantum adversary method [5], in its "general" form (the one used, for example, to 
lower-bound the quantum query complexity of inverting a permutation). For completeness, we 
now state Ambainis's adversary theorem in the form we will need. 

Theorem 15 (Ambainis [5]) Let A,B CI [M]^ be two sets of inputs with A n B = 0. Let 
R (1 A X B be a relation on input pairs, such that for every X £ A there exists at least one Y a B 
with {X, Y) £ R and vice versa. Given inputs X = (xi, . . . , x^v) in A and Y = (yi, . . . , y^v) in B, 
let 

qx,i= Vi^ix^^Vi I (X,y) Gi?], 
qY,i = ^T^[xi^yi I (X,y)Gi?]. 
Suppose that qx,iQy,i < « for every {X,Y) £ R and every i G [A^] such that Xi / yi. Then 

q{A,B) = n{i/^). 

Using Theorem 1151 we can prove the following lower bound on Q [Ai^Ai-i). 

Lemma 16 Let d = \\Ai — Ai-i\\, and assume d < N/2. Then Q {Ai,Ai-i) = VL ^ \J N/ d^ . 

Proof. Let Ae-i = (ai, 02, ■ ■ ■), and let i{l) , . . . ,i (r) be the r rows in Ai-i that get chopped. 
Recall that in going from Ae-i to Ae, we chop each row i (j) into a row of length aj(j) — and 
another row of length so that d = rP/2^. 

Now, given inputs X = (xi, . . . , x^) in A^^i and F = (yi, . . . , y^r) in A^, we set (A, y) G i? if 
and only if one can transform A to y in the following way: 
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Figure 2: In this example, = 11, r = 2, P/2^ = 2, and ai = 02 = 3. So we transform X to y by 
choosing hi = 1 and /i2 = 2, changing any two elements equal to hi and any two elements equal to 
/i2, and then swapping the four elements that we changed with four unchanged elements. 



(1) Find distinct hi, . . . ,hr G [M] such that for each j G [r], there are exactly Oj^j) indices i £ [N] 
satisfying Xi = hj. 

(2) For each j G [r], change exactly of the Xj's that are equal to hj to something else. 

(3) Swap the d elements of X that were changed in step (2) with any other d elements of X. 

The procedure is illustrated pictorially in Figure [2j Note that we can reverse the procedure in 
a natural way to go from Y back to X: 

(1) Find distinct hi, . . . ,hr G [M] such that for each j G [r], there are exactly indices i G [N] 
satisfying yi = hj. 

(2) For each j G [r], change all of the y^'s that are equal to hj to something else. 

(3) Swap the d elements of Y that were changed in step (2) with any other d elements of Y. 

Fix any (X, Y) G R, and let i G [N] be any index such that Xi 7^ yi. Then applying Theorem 
[T5| we claim that either qx,i < — Tv^- this, observe that either Xi is one of the 

"other d elements" in step (3) of the X ^ Y conversion, in which case 



or else yi is one of the "other d elements" in step (3) of the Y ^ X conversion, in which case 





Hence 



d 



qx,iqY,i < 



N-d 



So by Theorem [151 



Q{Ai,Ae-i) = n 



1 




N-d 
d 



) 



= n 




) 
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We now consider the case that many elements are chopped. Here we prove a lower bound by 
reduction from Set Equality. Given two sequences of integers Y £ [MY^ and Z G [M]'\ neither 
with any repeats, the Set Equality problem is to decide whether Y and Z are equal as sets or 
disjoint as sets, promised that one of these is the case. Set Equality is similar to the collision 
problem studied by Aaronson and Shi [3], but it lacks permutation symmetry, making it harder 
to prove a lower bound by the polynomial method. By combining the collision lower bound with 
Ambainis's adversary method, Midrijanis [18] was nevertheless able to show the following: 

Theorem 17 (Midrijanis [TS]) Q (Set Equality) = n (^(iV/log A^)^/^) . 

We now use Theorem [171 to prove another lower bound on Q {Ai, Ai-i) . 
Lemma 18 Suppose Ai was formed from Ag^i by chopping r rows. Then 

q{A,A,^,) = n(^[^^yy 

Proof. We will show how to embed a Set Equality instance of size r into the Ae versus Ae-i 
problem. 

Let Ai-i = (ai, . . . , au)- Also, let i (1) , . . . , z (r) G [u] be the r rows that are chopped in going 
from Ai-i to Ai, and let j (1) , . . . , j (u — r) £ [u] be the u — r rows that are not chopped. Recall 
that, in going from A^-^i to Ai, we chop each row i (k) into a row of length ajj-/,) — and another 
row of length 

Now let Y = (yi, . . . , y^) and Z = (zi, . . . , z^) be an instance of Set Equality. Then we 
construct an input X G [M]^ as follows. First, for each /c G [r], set aj(fc) — of the Xj's equal 
to yfc, and set P/2^ of the Xj's equal to z^. Next, let wi,W2, . . . G [M] be a list of numbers that 
are guaranteed not to be in y U Z. Then for each G [u — r], set aj(fc) of the Xj's equal to w^- 

It is easy to see that, if Y and Z are equal as sets, then X will have type Ai-i, while if Y and 
Z are disjoint as sets, then X will have type Ae. So in deciding whether X belongs to Ai or Ai-i, 
we also decide whether Y and Z are equal or disjoint. The lemma now follows from Theorem 1171 



2.4 Putting Everything Together 

Let C be a quantum query algorithm that distinguishes = A* from Bq = B*, and assume C is 
optimal: that is, it makes Q{A* ,B*) < Q (/) queries. As mentioned earlier, we can assume that 
Pr [C accepts X] depends only on the type of X. So let 

P£ := Pr [C accepts X G Ae] , 
qi := Pr [C accepts X £ Be] ■ 

Then by assumption, \po — qo\ > 1/3. Since pL = qi, this implies that either \po — pl\ > 1/6 or 
~ <1l\ ^ 1/6. Assume the former without loss of generality. 

Now let I3e := and observe that Yl'^if^i < |- the triangle inequality, it follows that 
there exists an £ G [L] such that \pe — pe-i\ > (3e- In other words, we get a Q (/)-query quantum 
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algorithm that distinguishes Ae from Ae-i with bias By Proposition [T3l this immediately 
implies 

'Q(/)~ 



Q{Ae,Ae-i) = O 



Pi 



or equivalently 



qif) = n 



QiAe,Ae-i) 



Now let d = \\Ai — Ai-i\\, and suppose Ae was produced from Ai--i by chopping r rows. Then 
d = < 2rN/2^. So combining Lemmas 1161 and 1181 we find that 



Q {Ae,A£-i) = 0. max • 



r \ log r 



d \ log r 

1/5' 



1/5- 



since the minimum occurs when r ~ '^(■I'J jl^ll _ \ii < (log2 T) —2, then combining Lemmas 1161 and 
141 we also have the lower bound 



Hence 



Q{Ae,Ae^i) = n 



Q(/) = < 



N 



8N/T'' 



ni^^j if£< (iog2r)-2 



Let us now make the choice c = 2/7, so that we get a lower bound of 

rpl/7 \ 



q{f) = n 



logis/^T 



in either case. Hence T = 0(Q {ff log^^ Q (/)). So by LemmaHSl 

R(/) = 0(ri+^logr) 
= 0(t9/^ logT) 
= 0(Q(/f log2iQ(/)). 



This completes the proof of Theorem \5\ 
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3 Quantum Lower Bounds Under The Uniform Distribution 



In this section, we consider the problems of P = BQP relative to a random oracle, and of simulating 
a T-query quantum algorithm on most inputs using r'^(i) classical queries. We show that these 
problems are connected to a fundamental conjecture about influences in low-degree polynomials. 

Let p : {0,1}^ — > [0,1] be a real polynomial. Given a string X e {0,1}''^, let denote 
X with the z*^ bit flipped. The following notions will play important roles in this section: the 
Li-variance Vr [p] of p, the influence Infj [p] of the i^^ variable Xi, the total influence Suminf [p], 
and the L2-norm ||p||n. 



Vr [p\ 
Infj [p] 



E 



[\p{X)-p{Y)\] 



E [\p{X)-p{X' 



N 



Suminf [p] := Infj [p] , 



i=l 



II ii2 



E 

xe{o,i}^ 



Recall Conjecture [6l which stated that hounded polynomials have influential variables: that is, for 
every degree-d polynomial p : M such that < p{X) < 1 for all X G {0, 1}^, there exists 

an i G [N] such that Infj [p] > (Vr [p] /d)^^^\ Assuming Conjecture [U we will derive a number of 
consequences for quantum complexity theory. 

To do so, we first need a lemma that slightly generalizes a result of Shi |21j . 

Lemma 19 Suppose a quantum algorithm makes T queries, and accepts the input X S {0, 1}^ 
with probability p (X). Then Suminf [p] = O (T). 

Proof. Let \ipx) be the final state of the quantum algorithm if the input is X, and let 



E :-- 



E 

xe{o,i}^,ie[Af] 



\Ux)-\^_ 



Then Lemma 4.3 of Shi [21] implies that E < 2T/N. Hence 

Suminf [p] = iV • E [\p{X)-p(X' 
X£{o,i}^ ,ie[N] 



< N ■2E < AT. 



We also need the following lemma of Beals et al. [6]. 

Lemma 20 ([6j) Suppose a quantum algorithm Q makes T queries to a Boolean input X G 
{0,1}^. Then Q's acceptance probability is a real multilinear polynomial p{X), of degree at 
most 2T. 



We now prove our first consequence of Conjecture E) namely, that it implies the folklore Con- 
jecture [H 
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Theorem 21 Suppose Conjecturel^ holds, and let £,6 > 0. Then given any quantum algorithm 
Q that makes T queries to a Boolean input X , there exists a deterministic classical algorithm that 
makes poly (T, 1/e, 1/5) queries, and that approximates Q's acceptance probability to within an 
additive constant e on a 1 — 5 fraction of inputs. 

Proof. Let piX) be the probabihty that Q accepts input X = xi . . .xn- Then Lemma [20] savs 
that p is a real polynomial of degree at most 2T. Assume Conjecture [6l that for every such p, 
there exists a variable i satisfying Infj [p] > q (Vr [p] /T), for some fixed polynomial q. Under that 
assumption, we give a classical algorithm C that makes poly (T, 1/e, 1/6) queries to the Xj's, and 
that approximates p (X) on most inputs X. 



set po := p 

for j := 0,1,2,...: 

if Vr [pj] < £5 

output p {X) PS E^e{o,i}Jv-j [Pj (y)] and halt 

else 

find an i e [N - j] such that Infj [pj] > q{e5/T) 
query Xi , and let pj+i : M^^-' — > M be the polynomial 
induced by the answer 



If C halts, then by assumption Vr [pt] < £6. So clearly 

E , [\p, {X) - E < E [\p, {X) -p, {Y)\] < £d 
xe{o,i}^-^ x,yG{o,i}^-^ 

as well. By Markov's inequality, this implies 

Pr A\PjiX)-E[pj]\>£]<6, 

XG{0,1}^-^ 

which proves C's correctness. 

On the other hand, suppose Vr \pj] > £5. Then by Conjecture [6l there exists an i such that 



M,W>.(^)>.(f). 



So if we query Xi, then we produce a new polynomial Pj+i such that 

Suminf [pj+i] < Suminf [pj] — q ( — ] • 



But Suminf [po] = O (T) by Lemma [T9l It follows that C halts after at most 

Suminf fpnl ^ /TX^^^^ 



q{£5/T) ~ \£5 J 



iterations, each of which queries exactly one Xj. 
An immediate corollary is the following: 
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Corollary 22 Suppose ConjecturelEi holds. Then (/) < (Q^ (/) /5)^^^^ for all Boolean func- 
tions f and all e,5 > 0. 

Proof. Let Q be a quantum algorithm that evaluates / {X), with bounded error, on a 1 — e fraction 
of inputs X £{0,iy\ Let p (X) := Pr [Q accepts X]. Now run the classical simulation algorithm 
C from Theorem I2H to obtain an estimate p{X) of p{X) such that 



Pr 

xe{o,i}'^ 



\piX)-p{X)\< 
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> 1 



Output / (X) = 1 Hp {X) > i and / (X) = otherwise. By the theorem, this requires poly (T, 1/6) 
queries to X, and by the union bound it successfully computes / (X) on at least a 1 — e — 5 fraction 
of inputs X. m 

We also get the following complexity consequence: 

Theorem 23 Suppose ConjecturelBi holds. Then P = P'^^ implies BQP"^ C AvgP"^ with proba- 
bility 1 for a random oracle A. 

Proof. Let Q be a polynomial-time quantum Turing machine that queries an oracle A, and 
assume Q decides some language L £ BQP^ with bounded error. Given an input x G {0, 1}*^, let 
Px (A) := Pr [Q^ (x) accepts] . Then clearly p^ (A) depends only on some finite prefix B of A, of 
size N = 2P°^y("^. Furthermore, Lemma [20] implies that px is a polynomial in the bits of B, of 
degree at most poly (n) . 

Assume Conjecture [6] as well as P = P*'^. Then we claim that there exists a deterministic 
polynomial-time algorithm C such that for all Q and x £ {0, 1}", 



Pr 

A 



\P. (A) 



■Px(.A)\ > ^ 



1 



(2) 



where px (A) is the output of C given input x and oracle A. This C is essentially just the algorithm 
from Theorem [2TJ The key point is that we can implement C using not only poly (n) queries to 
A, but also poly (n) computation steps. 

To prove the claim, let M be any of the 2P°'y(") monomials in the polynomial pj from Theorem 
EH and let ajv/ be the coefficient of M. Then notice that aM can be computed to poly (n) bits of 
precision m P*^, by the same techniques used to show BQP C P#^ [8]. Therefore the expectation 



E 

ye{o,i}^- 



[p. (X)] = ^ 



M 



2l^l 



can be computed in P^"^ as well. The other two quantities that arise in the algorithm — Vr \pj] and 
Infj [pj] — can be computed in the second level of the counting hierarchy CH = P*^ U P*^*'' U • • • 
(since they involve an exponential sum inside of an absolute value sign, and another exponential 
sum outside of it). This means that finding an i such that Infj [pj] > q (e^/T) is in the third 
level of the counting hierarchy. But under the assumption P = P*^, the entire counting hierarchy 
collapses to P. Therefore all of the computations needed to implement C take polynomial time. 

Now let 6n {A) be the fraction of inputs x G {0, 1}" such that \px (A) — px {A)\ > j^. Then by 
([2]) together with Markov's inequality, 



Pr 

A 



Sn (A) > - 

n 



< 



1 
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Since Xln^i converges, it follows that 5„ {A) < ^ for all but finitely many values of n, with 
probability 1 over A. Assuming this occurs, we can simply hardwire the behavior of Q on the 
remaining n's into our classical simulation procedure C. Hence L £ AvgP^. 

Since the number of BQP^ languages is countable, the above implies that L G AvgP"^ for every 
L £ BQP"^ simultaneously (that is, BQP"^ C AvgP"^) with probability 1 over A. m 

As a side note, suppose we had an extremely strong variant of Conjecture [6l one that implied 
something like 



Pr 

A 



\p, (A) -p,{A)\ > ^ 



1 

< 



exp (n) 

in place of ([2|). Then we could eliminate the need for AvgP in Theorem 1231 ^-nd show that P = P*^ 
implies P"^ = BQP^ with probability 1 for a random oracle A. 

We conclude this section with some unconditional results. These results will use Theorem [9] 
of Dinur et al. |13J: that for every degree-d polynomial p : — > M such that < p{X) < 1 for 
all X G {0, 1} , there exists a polynomial p depending on at most 2*-^('^)/e^ variables such that 

ll~ l|2 ^ 

Theorem has the following simple corollary. 
Corollary 24 Suppose a quantum algorithm Q makes T queries to a Boolean input X G {0,1}''^. 



Then for all q, <5 > 0, we can approximate Q 's acceptance probability to within an additive constant 
a, on a 1 — 5 fraction of inputs, by 
classical queries are nonadaptive.) 



a, on a 1 — 5 fraction of inputs, by making deterministic classical queries to X. (Indeed, the 



E 

xe{o,i}^ 



{p{X)-p{X)f 



Proof. Let p{X) := Pr [Q accepts X]. Then p is a degree-2r real polynomial by Lemma [20l So 
by Theorem [9l there exists a polynomial p, depending on K = variables Xjj , . . . , , such 

that 

By Cauchy-Schwarz, then, 
so by Markov's inequality 



E [\p{X)-p{X)\]<a5, 



Pr [\p{X)-p{X)\>a]<5. 
xe{o,i} 

Thus, our algorithm is simply to query and then output p[X) as our estimate for 

p{X). m 
Likewise: 

Corollary 25 (/) < 2<^(Q=(^))/5^ for all Boolean functions f and all e,S>0. 

Proof. Set a to any constant less than 1/6, then use the algorithm of Corollary [23] to simulate the 
e-approximate quantum algorithm for /. Output / {X) = 1 if p{X) > i and / {X) = otherwise. 
■ 

Given an oracle A, let BQP'^t^"^' be the class of languages decidable by a BQP machine able to 
make O (log n) queries to A. Also, let AvgP|| be the class of languages decidable, with probability 
1 — o(l) over X G {0, 1}", by a P machine able to make poly (n) parallel (nonadaptive) queries to 
A. Then we get the following unconditional variant of Theorem | 
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Theorem 26 Suppose P = P*^. Then BQP'^''"^' C AvgPj| with probability 1 for a random oracle 
A. 

Proof. The proof is essentially the same as that of Theorem [23l except that we use Corollary [23] 
in place of Conjecture [H In the proof of Corollary [24l observe that the condition 

E [\p{X)-piX)\]<a5 

Xg{0,l} 

implies 

E [\p,{X)-p{X)\]<a5 (3) 
xe{o,i}'^ 

as well, where p^ (X) equals the mean of p (Y) over all inputs Y that agree with X on Xjj , . . . , rcj^ . 
Thus, given a quantum algorithm that makes T queries to an oracle string, the computational 
problem that we need to solve boils down to finding a subset of the oracle bits , . . . , Xj^ such 
that K = '^^iji and ([3]) holds. Just like in Theorem 1231 this problem is solvable in the counting 
hierarchy CH = P'^^ U P*^**" U • • • . So if we assume P = P*^, it is also solvable in P. 

In Theorem [23l the conclusion we got was BQP"^ C AvgP"^ with probability 1 for a random 
oracle A. In our case, the number of classical queries K is exponential (rather than polynomial) 
in the number of quantum queries T, so we only get BQP^l^^^l C AvgP^. On the other hand, since 
the classical queries are nonadaptive, we can strengthen the conclusion to BQP"^''"^] C AvgP||. ■ 



4 Open Problems 

It would be nice to improve the R (/) = 0(Q (/)^ polylog Q (/)) bound for all symmetric problems. 
As mentioned earlier, we conjecture that the right answer is R (/) = 0(Q (fY). Note that if one 
could tighten Midrijanis's quantum lower bound for Set Equality [18j from ^}{{N/ logN)^^^) 
to Q{N^/^), then an improvement to R(/) = 0(Q (/)^ polylog Q (/)) would follow immediately. 
However, it seems better to avoid using Set Equality altogether. After all, it is a curious feature 
of our proof that, to get a lower bound for all symmetric problems, we need to reduce from the 
non-symmetric Set Equality problem, which in turn is lower-bounded by a reduction from the 
symmetric collision problem! 

We also conjecture that R (/) < Q (Z)'^'-^'' for all partial functions / that are symmetric only 
under permuting the inputs (and not necessarily the outputs). Proving this seems to require a 
new approach. 

It would be interesting to reprove the R(/) < Q(/)^^^^ bound using only the polynomial 
method, and not the adversary method. Or, to rephrase this as a purely classical question: for all 
X = {xi, . . . ,xn) in [-^]^) let Bx be the N x M matrix whose {i,jY^ entry is 1 if = j and 
otherwise. Then given a set S C [MY^ and a function / : 5 ^ {0, 1}, let deg (/) be the minimum 
degree of a real polynomial p : M.'^^ — > M such that 

(i) 0<p{Bx)<l for all X £ [M]^ , and 

(ii) \p (Bx) -fiX)\<l for ah X £ S. 

Then is it the case that R (/) < deg (Z)*^^^^ for all permutation-invariant functions /? 
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On the random oracle side, the obvious problem is to prove Conjecture [6] — thereby establishing 
that De (/) and (/) are polynomially related, and all the other consequences shown in Section 
[3l Alternatively, one could look for some technique that was tailored to polynomials p that arise 
as the acceptance probabilities of quantum algorithms. In this way, one could conceivably solve 

(/) versus (/) and the other quantum problems, without settling the general conjecture about 
bounded polynomials. 
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6 Appendix: The Boolean Case 

Given a partial Boolean function / : {0,1}^ — > {0,1,*}, call / symmetric if f (X) depends only 
on the Hamming weight \X\ := xi -|- • • • -|- xat. For completeness, in this appendix we prove the 
following basic fact: 

Theorem 27 R(/) = 0(Q (fY) for every partial symmetric Boolean function f. 

For total symmetric Boolean functions, Theorem 1271 was already shown by Beals et al. [^, 
using an approximation theory result of Paturi ^_0.j. Indeed, in the total case one even has 
D (/) = 0(Q (/)^). So the new twist is just that / can be partial. 

Abusing notation, let / {k) £ {0, 1, *} be the value of / on all inputs of Hamming weight k 
(where as usual, * means 'undefined'). Then we have the following quantum lower bound: 
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Lemma 28 Suppose that / (a) = and / (6) = 1 or vice versa, where a < b and a < N/2. Then 

Q(/) = ^(^)- 

Proof. This follows from a straightforward application of Ambainis's adversary theorem (Theorem 
[T5]) . Specifically, let A,BC1 {0,1}^ be the sets of all strings of Hamming weights a and b 
respectively, and for all X G ^ and Y £ B, put {X,Y) £ R if and only if X ^ Y (that is, Xi < m 
for all i G [N]). Then 

Alternatively, this lemma can be proved using the approximation theory result of Paturi |20j . 
following Deals et al. [6]. ■ 

In particular, if we set fi := jj and e := ^jf^, then Q (/) = i7(v^/e)- On the other hand, we 
also have the following randomized upper bound, which follows from a Chernoff bound (similar to 
Lemma llip : 

Lemma 29 Assume /3 > e > 0. By making O (/?/e^) queries to an N-bit string X, a classical 
sampling algorithm can estimate the fraction fi := \X\ /N ofl bits to within an additive error zize/3, 
with success probability at least (say) 2/3. 



So assume the function / is non-constant, and let 



VbN 

7 := max . (4) 

/(a)=o,/(fe)=i b-a 

Assume without loss of generality that the maximum of (jl]) is achieved when a < b and a < N/2, 
if necessary by applying the transformations / {X) ^ 1 — / (X) and / (X) f (N — X). Now 
consider the following randomized algorithm to evaluate /, which makes T := O (7^) queries: 



Choose indices ii,...,iT G [A^] uniformly at random with replacement 
Query xi^, . . . ,Xij. 

If there exists a b £ {0, . . . , N} such that f (b) = 1 and \k - b\ < 

output / (X) = 1 
Otherwise output / (X) = 



By Lemma [29l the above algorithm succeeds with probability at least 2/3, provided we choose T 
suitably large. Hence R(/) = O (7'^). On the other hand. Lemma [28l implies that Q (/) = Q (7). 
Hence R(/) = 0(Q (/)^), completing the proof of Theorem [271 
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